В WordPress-plugin , oo leh in ka badan 700 oo rakibaad oo firfircoon, Nuglaan u oggolaanaya amarrada aan kala sooca lahayn iyo qoraallada PHP in lagu fuliyo server-ka. Arrintu waxay saamaysaa noocyada Maareeyaha Faylka 6.0 ilaa 6.8 waxaana lagu hagaajiyay nooca 6.9.
Faylka Maareeyaha Faylka wuxuu bixiyaa qalabka maaraynta faylka ee maamulaha. WordPress, iyadoo la adeegsanayo maktabadda ku jirta maaraynta faylka heerka hoose Koodhka isha maktabadda elFinder wuxuu ka kooban yahay faylasha tusaalaha koodhka, kuwaas oo lagu bixiyo galka shaqada oo leh kordhinta ".dist". Nuglaanta waxaa sababa xaqiiqda ah in inta lagu jiro qaybinta maktabadda, faylka "connector.minimal.php.dist" loo beddelay "connector.minimal.php" wuxuuna diyaar u noqday fulinta marka la dirayo codsiyada dibadda. Qoraalkani wuxuu u oggolaanayaa hawlgal kasta oo faylal ah (soo gelinta, furitaanka, tifaftiraha, dib u magacaabista, rm, iwm.) in la sameeyo, maadaama xuduudaheeda loo gudbiyo shaqada run() ee plugin-ka ugu weyn, kaas oo loo isticmaali karo in lagu beddelo faylasha PHP gudaha WordPress iyo socodsiinta kood aan kala sooc lahayn.
Khatarta waxaa sii xumeynaya xaqiiqda ah in nuglaanta ay durbaba Si loo fuliyo weeraro otomaatig ah, sawir ka kooban koodhka PHP ayaa loo soo geliyaa galka "plugins/wp-file-manager/lib/files/" iyadoo la adeegsanayo amarka "upload". Sawirka waxaa markaa loogu magac daray qoraal PHP ah oo leh magac si aan kala sooc lahayn loo doortay oo ka kooban qoraalka "hard" ama "x." (tusaale ahaan, hardfork.php, hardfind.php, x.php, iwm.). Marka la fuliyo, koodhka PHP wuxuu ku darayaa albaab dambe faylasha /wp-admin/admin-ajax.php iyo /wp-includes/user.php, taasoo siinaysa weeraryahannada inay galaan is-dhexgalka maamulka ee goobta. Ka faa'iidaysiga waxaa lagu gaaraa iyadoo codsi POST ah loo dirayo faylka "wp-file-manager/lib/php/connector.minimal.php."
Waxaa xusid mudan in ka dib jabsiga, marka laga soo tago ka bixitaanka albaabka dambe, isbeddello ayaa la sameeyaa si loo ilaaliyo marin u helidda dheeraadka ah ee faylka connector.minimal.php, kaas oo ka kooban nuglaanta, si loo xakameeyo suurtagalnimada in weeraryahanno kale ay weeraraan server-ka.
Isku daygii ugu horreeyay ee weerar ayaa la ogaaday Sebtembar 1 saacadda 7 subaxnimo (UTC).
12:33 PM (UTC), horumariyayaasha plugin-ka File Manager ayaa sii daayay balastar. Sida laga soo xigtay Wordfence, oo ah shirkadda ogaatay nuglaanta, dab-damiskoodu wuxuu xannibay qiyaastii 450 oo isku day ah oo lagu doonayay in looga faa'iidaysto nuglaanta hal maalin gudaheed. Baaritaanka shabakadda ayaa shaaca ka qaaday in 52% mareegaha isticmaala plugin-ka aan weli la cusbooneysiin oo ay weli yihiin kuwo nugul. Ka dib markii la rakibo cusbooneysiinta, waa fikrad wanaagsan in la hubiyo diiwaanka server-ka HTTP wicitaanada qoraalka "connector.minimal.php" si loo ogaado in nidaamka la jabsaday.
Intaa waxaa dheer, waxaa lagu ogaan karaa xal sax ah. kaas oo lagu soo jeediyay .
Source: opennet.ru
